CVE-2026-18700: Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service
An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result in a server crash, leading to a denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18700?
The severity of CVE-2026-18700 is classified as medium with a score of 6.5.
What impact does CVE-2026-18700 have on MongoDB?
CVE-2026-18700 can lead to a denial of service due to a use-after-free condition in MongoDB's geospatial validation.
Who is affected by CVE-2026-18700?
CVE-2026-18700 affects authenticated users with write privileges on MongoDB Server.
How do I mitigate CVE-2026-18700?
To mitigate CVE-2026-18700, ensure that you apply any available security patches for MongoDB Server.
What is the cause of CVE-2026-18700?
CVE-2026-18700 is caused by an issue in the geospatial validation mechanism that can lead to memory being accessed after it has been freed.